How do I set up a submission management system for managing change control in a small generic drug manufacturer?

Here’s a practical way to set up a submission management system for change control in a small generic drug manufacturer. I’m assuming you want a system that ties together change control, regulatory assessment, implementation tracking, and submission/filing updates in a way that is lightweight but still GMP- and compliance-ready.

1) Define the purpose and scope

Start by deciding exactly what the system must manage.

Typical scope includes:

• Product changes: formulation, process, specs, packaging, labeling, shelf life
• Facility/equipment changes: manufacturing site, utilities, equipment replacement
• Supplier/material changes: API, excipients, packaging components, contract manufacturers
• Quality system changes: SOP revisions, validation approach, testing methods
• Regulatory submissions: supplements, variations, annual reports, notifications, correspondence
• Commitments tracking: post-approval commitments, CMC commitments, study commitments

For a small company, it’s best to keep one system that links:

• Change request
• Impact assessment
• Regulatory submission decision
• Implementation
• Effectiveness verification
• Closure

---

2) Build a simple end-to-end workflow

A good workflow is:

Step 1: Change initiation

Anyone proposes a change through a controlled form.

Minimum fields:

• Change title
• Product(s) affected
• Site/area affected
• Reason for change
• Proposed change description
• Proposed effective date
• Urgency/criticality
• Requestor
• Attachments

Step 2: Triage and classification

A small cross-functional group reviews the change to determine:

• Is it GMP impact only, or also regulatory impact?
• Does it affect approved dossier information?
• Does it require customer notification?
• Does it require validation/stability/comparability work?
• Is it major/minor/admin change depending on region?

Step 3: Impact assessment

Assess impact from:

• Regulatory/CMC
• Quality
• Manufacturing
• Validation
• Supply chain
• Stability
• Data integrity
• Pharmacovigilance, if relevant

This step should result in a decision:

• No submission required
• Submission required before implementation
• Submission required after implementation
• Customer notification only
• Internal documentation update only

Step 4: Submission planning

If filing is needed, define:

• Jurisdiction/market
• Submission type
• Required dossier sections
• Data package needed
• Responsible owner
• Target submission date
• Approval gate before implementation

Step 5: Execution and tracking

Track:

• Testing/validation/stability completion
• SOP/batch record updates
• Label/artwork updates
• Training completion
• Submission preparation
• Submission dispatch
• Agency responses
• Approval/acknowledgment

Step 6: Closure

Close only when:

• Change is implemented
• Required submission is accepted/approved/acknowledged
• All documents are updated
• Training is done
• Effectiveness check is completed

---

3) Create core documents and forms

For a small manufacturer, keep the document set lean.

A. Change Control Request Form

Include:

• Change ID
• Product/site
• Description
• Justification
• Risk level
• Attachments
• Proposed effective date

B. Regulatory Impact Assessment Form

Include:

• Markets affected
• Dossier sections affected
• Filing category
• Need for authority notification/approval
• Need for customer notification
• Need for stability/validation data

C. Submission Planning Tracker

Include:

• Change ID
• Submission type
• Market
• Due date
• Status
• Owner
• Agency feedback
• Approval date

D. Implementation Checklist

Include:

• SOP updates
• Batch record changes
• Label changes
• Training
• Validation
• Stability commitment
• Deviation/cAPA links if relevant

E. Closure Checklist

Include:

• Submission complete
• Approval/acknowledgment received
• Implementation verified
• Documentation updated
• Training complete
• Effectiveness check complete

---

4) Use a risk-based prioritization model

Not every change needs the same level of review.

A simple model:

• Low risk: typographical corrections, administrative updates, like-for-like equipment replacement with no GMP impact
• Medium risk: supplier change with equivalent material, packaging changes, minor process changes
• High risk: formulation, process, site, analytical method, critical equipment, specification changes

For each change, score:

• Product quality impact
• Patient safety impact
• Regulatory impact
• Supply disruption risk
• Data/integrity risk

This helps determine:

• Review depth
• Submission urgency
• Approval authority level
• Validation/stability needs

---

5) Define roles and responsibilities

In a small company, clearly assign owners.

Typical roles:

• Change initiator: submits request
• QA: owns change control process, ensures GMP compliance
• Regulatory Affairs: determines filing requirements and prepares submissions
• Manufacturing/Operations: assesses implementation feasibility
• QC/Analytical: assesses testing/method impacts
• Validation/Technical: determines qualification/validation needs
• Supply Chain: evaluates material/supplier impacts
• Senior management: approves high-risk or resource-intensive changes

A simple RACI matrix is very helpful.

---

6) Decide what system platform to use

For a small generic manufacturer, you do not necessarily need a full enterprise QMS at the start.

Options:

Option 1: Controlled spreadsheets + shared drive

Best for very small teams, but only if well controlled.

• Use unique IDs
• Restrict editing
• Keep version control
• Maintain audit trail manually or through document control

Option 2: Simple eQMS or workflow tool

Better balance of control and cost. Look for:

• Change control workflows
• Document control
• Training links
• Task assignments
• Audit trail
• Role-based access

Option 3: ERP/QMS integration

Best if you already have systems in place. Integrate change control with:

• Document management
• Batch records
• Training
• CAPA
• Supplier management
• Regulatory tracking

For a small generic manufacturer, a cloud eQMS with a change workflow module is often the best practical choice.

---

7) Build the submission decision matrix

This is one of the most important parts.

Create a matrix that maps:

• Type of change
• Market/region
• Submission requirement
• Implementation timing

Example categories:

• No regulatory filing
• Notify authority before implementation
• Notify authority after implementation
• Prior approval supplement/variation
• Annual report only
• Customer notification required
• No action outside internal documentation

This matrix should be maintained by Regulatory Affairs and approved by QA.

---

8) Track deadlines and commitments

Many change-related failures happen because deadlines are missed.

Track:

• Planned submission date
• Agency due date
• Implementation target
• Stability timepoint
• Validation completion date
• Response due date
• Internal owner for each action

Use alerts/escalations for:

• Overdue tasks
• Changes waiting on regulatory decision
• Changes implemented without required filing
• Changes with open commitments

---

9) Connect change control to document control

Every approved change should trigger document updates:

• SOPs
• Master batch records
• Specifications
• Methods
• Artwork/labeling
• Supplier agreements
• Validation protocols/reports
• Risk assessments

Best practice:

• No closure until documents are updated and approved
• Old versions are retired under document control
• Training links to the revised documents

---

10) Put governance in place

Set a regular meeting cadence:

• Weekly or biweekly change review board
• Monthly regulatory/change status review
• Quarterly metrics review

Typical agenda:

• New changes
• High-risk changes
• Submission status
• Open actions
• Overdue items
• Regulatory commitments

---

11) Establish KPIs

Useful metrics:

• Number of changes opened/closed
• Average cycle time
• % changes with regulatory assessment completed on time
• % changes requiring submissions
• % submissions approved on first cycle
• Overdue actions
• Changes implemented before approval when not allowed
• Training completion rate

These help identify bottlenecks and compliance gaps.

---

12) Validate the system appropriately

Even a small system needs control.

At minimum:

• Define procedures
• Train users
• Control access
• Ensure audit trail/version control
• Periodically review records
• Test the workflow before go-live
• Verify backups and retention

If using a computerized system, assess whether it needs formal validation based on your quality and data integrity requirements.

---

13) Recommended minimal SOP set

A lean SOP package might include:

1. Change Control Procedure
2. Regulatory Assessment and Submission Decision Procedure
3. Document Control Procedure
4. Training Procedure
5. Supplier Change Management Procedure
6. Validation/Qualification Change Procedure
7. Label/Artwork Change Procedure
8. Periodic Review of Open Changes and Commitments

---

14) Suggested implementation roadmap

Phase 1: Design

• Map current process
• Define change categories
• Define roles
• Draft forms and SOPs

Phase 2: Pilot

• Use the system on a few real changes
• Fix gaps in routing, approvals, and tracking

Phase 3: Go-live

• Train users
• Start with all new changes
• Migrate only open critical legacy changes

Phase 4: Improve

• Add dashboards
• Add submission matrix refinements
• Integrate with document control and training

---

15) Practical small-company setup

If you want a simple but effective setup, I’d recommend:

• One Change Control Log
• One Change Request Form
• One Regulatory Impact Assessment
• One Submission Tracker
• One Closure Checklist
• Monthly cross-functional review meeting
• A controlled spreadsheet or simple eQMS workflow
• A region-specific submission decision matrix

That is enough to manage a small generic drug manufacturer well, provided the process is disciplined.

---

If you want, I can also provide:

1. a sample change control workflow chart,
2. a template form set, or
3. a spreadsheet layout for tracking submissions and change control.